Cisco
CompTIA
ISC
EC-Council
EXIN
Fortinet
ITIL
Juniper
Microsoft
VMware
Avaya
SAP
Google
NVIDIA
Salesforce
Amazon
Palo Alto Networks
ISC2
Splunk
ServiceNow
All Vendors
  2. Home
  3. Exams
  4. EC-Council
  5. 312-50v13

EC-Council 312-50v13 Exam Questions
Certified Ethical Hacker v13 (Page 20 )

Updated On: 12-May-2026
Page 20 of 105
PDF with 862 Questions

As a Certified Ethical Hacker, you are conducting a footprinting and reconnaissance operation against a target organization. You discover a range of IP addresses associated with the target using the SecurityTrails tool. Now, you need to perform a reverse DNS lookup on these IP addresses to find the associated domain names, as well as determine the nameservers and mail exchange (MX) records. Which of the following DNSRecon commands would be most effective for this purpose?

  1. dnsrecon -r 192.168.1.0/24 -n nsl.example.com -t axfr
  2. dnsrecon -r 10.0.0.0/24 -n nsl.example.com -t zonewalk
  3. dnsrecon -r 162.241.216.0/24 -n nsl.example.com -t std
  4. dnsrecon -r 162.241.216.0/24 -d example.com -t brt

Answer(s): C

Explanation:

The -t std option performs standard DNS reconnaissance, including reverse lookups, NS, and MX discovery across the target range, making it suitable for mapping domain names and mail/nameserver records.
A) Uses -t axfr (zone transfer) which requires server允许 zone transfer; not universally allowed and not focused on reverse lookups for NS/MX.
B) Uses -t zonewalk which enumerates zones via zone walking; not specifically tailored for reverse DNS/NS/MX for the given range.
D) Uses -d rather than -n for target domain; brt mode is brute force heavy and not ideal for efficient reverse DNS and record discovery.



You are an ethical hacker tasked with conducting an enumeration of a company's network. Given a Windows Answered Marked for Review 37.6% system with NetBIOS enabled, port 139 open, and file and printer sharing active, you are about to run some nbtstat commands to enumerate NetBIOS names. The company uses IPv6 for its network. Which of the following actions should you take next?

  1. Switch to an enumeration tool that supports IPv6
  2. Use nbtstat -a followed by the IPv6 address of the target machine
  3. Use nbtstat -c to get the contents of the NetBIOS name cache
  4. Utilize Nmap Scripting Engine (NSE) for NetBIOS enumeration

Answer(s): A

Explanation:

NetBIOS enumeration over IPv6 requires a tool that supports IPv6; switching to a compatible enumeration tool ensures proper discovery and name resolution in an IPv6 environment.
A) Correct: IPv6 support is required for accurate NetBIOS enumeration in this network.
B) Incorrect: nbtstat operates over NetBIOS/IPv4; IPv6 address usage is unsupported here.
C) Incorrect: nbtstat -c accesses the NetBIOS cache, not appropriate for initial enumeration in IPv6 contexts.
D) Incorrect: NSE can perform NetBIOS-related checks, but the explicit need is an IPv6-capable enumeration tool; NSE is not a direct requirement and may not handle IPv6 as needed.



During a red team assessment, a CEH is given a task to perform network scanning on the target network without revealing its IP address. They are also required to find an open port and the services available on the target machine. What scanning technique should they employ, and which command in Zenmap should they

use?

  1. Use SCTP INIT Scan with the command "-sY"
  2. Use UDP Raw ICMP Port Unreachable Scanning with the command "-sU"
  3. Use the ACK flag probe scanning technique with the command "-sA"
  4. Use the IDLE/IPID header scan technique with the command "-sI"

Answer(s): D

Explanation:

Using IDLE/IPID header scan (stealth scan) via -sI hides the source IP and fingerprinting while discovering open ports and services, aligning with anonymous network enumeration in red team assessments. It leverages a zombie host to probe target ports without directly revealing the scanning host.
A) SCTP INIT Scan (-sY) targets SCTP and is not appropriate for stealthy generic port/service discovery on IPv4 host networks.
B) UDP Raw ICMP Port Unreachable (-sU) tests UDP ports but is noisy and often blocked, not ideal for stealthy comprehensive service discovery.
C) ACK flag probe (-sA) determines firewall/filtering state, not reliable for identifying open ports or services.



A large corporation is planning to implement preventive measures to counter a broad range of social engineering techniques. The organization has implemented a signature-based IDS, intrusion detection system, to detect known attack payloads and network flow analysis to monitor data entering and leaving the network. The organization is deliberating on the next step. Considering the information provided about various social engineering techniques, what should be the organization's next course of action?

  1. Implement endpoint detection and response solution to oversee endpoint activities
  2. Set up a honeypot to attract potential attackers into a controlled environment for analysis
  3. Deploy more security personnel to physically monitor key points of access
  4. Organize regular employee awareness training regarding social engineering techniques and preventive measures

Answer(s): D

Explanation:

A concise training-first approach is essential to counter social engineering; regular employee awareness training equips staff to recognize and resist social manipulation, reducing successful breaches beyond technical controls. It complements signature-based IDS and data flow monitoring by addressing human factors.
A) Endpoint detection and response focuses on endpoint threats but does not directly reduce susceptibility to social engineering at the human level. B) Honeypots attract attackers for analysis but do not mitigate social engineering risks or educate employees. C) Increasing physical security personnel addresses access control but not the broader spectrum of social engineering techniques or user awareness. D) Regular training directly mitigates social engineering risk through knowledge and behavioral change.



An audacious attacker is targeting a web server you oversee. He intends to perform a Slow HTTP POST attack, by manipulating 'a' HTTP connection. Each connection sends a byte of data every 'b' second, effectively holding up the connections for an extended period. Your server is designed to manage 'm' connections per second, but any connections exceeding this number tend to overwhelm the system. Given 'a=100' and variable 'm', along with the attacker's intention of maximizing the attack duration 'D=a*b', consider the following scenarios. Which is most likely to result in the longest duration of server unavailability?

  1. m=90, b=15: The server can manage 90 connections per second, but the attacker's 100 connections exceed this, and with each connection held up for 15 seconds, the attack duration could be significant.
  2. m=105, b=12: The server can manage 105 connections per second, more than the attacker's 100 connections, likely maintaining operation despite a moderate hold-up time.
  3. m=110, b=20: Despite the attacker sending 100 connections, the server can handle 110 connections per second, therefore likely staying operative, regardless of the hold-up time per connection.
  4. m=95, b=10: Here, the server can handle 95 connections per second, but it falls short against the attacker's 100 connections, albeit the hold-up time per connection is lower.

Answer(s): A

Explanation:

A) The correct choice. With m=90 and b=15, the attacker can exceed the server’s per-second capacity and each connection lasts 15 seconds, causing sustained resource contention and longer unavailability as new connections continually arrive and persist. The attack duration D=a*b=100*15=1500 units; the server’s intake is overwhelmed, delaying normal processing.
B) Although m=105 > 100, the server can absorb the attack rate, and shorter hold-up (b=12) reduces persistence, limiting duration of unavailability.
C) m=110 > 100 and b=20 would still allow load acceptance; higher b increases duration per connection but the capacity surplus minimizes impact, reducing outage time.
D) m=95 < 100 means overcapacity; however, b=10 is shorter than A, reducing persistence, making outage shorter than with A.



A large organization has recently performed a vulnerability assessment using Nessus Professional, and the security team is now preparing the final report. They have identified a high-risk vulnerability, named XYZ, which could potentially allow unauthorized access to the network. In preparing the report, which of the following

elements would NOT be typically included in the detailed documentation for this specific vulnerability?

  1. Proof of concept (PoC) of the vulnerability, if possible, to demonstrate its potential impact on the system.
  2. The total number of high, medium, and low-risk vulnerabilities detected throughout the network.
  3. The list of all affected systems within the organization that are susceptible to the identified vulnerability.
  4. The CVE ID of the vulnerability and its mapping to the vulnerability's name, XYZ.

Answer(s): A

Explanation:

A) PoC of the vulnerability, if possible, to demonstrate its potential impact on the system, would not typically be included in detailed vulnerability documentation for a single vulnerability due to potential safety and misuse concerns; PoCs are often kept internal or redacted when sharing publicly. B) The total counts of vulnerabilities by risk level are part of the overall assessment reporting. C) A list of affected systems is essential for remediation planning and risk prioritization. D) CVE ID and mapping to the vulnerability name provide standard identification and traceability.



Recently, the employees of a company have been receiving emails that seem to be from their colleagues, but with suspicious attachments. When opened, these attachments appear to install malware on their systems. The IT department suspects that this is a targeted malware attack. Which of the following measures would be the most effective in preventing such attacks?

  1. Disabling Autorun functionality on all drives
  2. Avoiding the use of outdated web browsers and email software
  3. Regularly scan systems for any new files and examine them
  4. Applying the latest patches and updating software programs

Answer(s): D

Explanation:

A targeted phishing/malware campaign is best mitigated by keeping software up to date with the latest patches and updates, closing known vuln vectors and reducing exploit opportunities.
A) Disabling Autorun helps against removable-media malware, not primarily targeted email attachments.
B) Avoiding outdated browsers/software reduces risk but does not guarantee protection against evolving exploits in emails.
C) Regular scans help detect infections after the fact, not prevent initial compromise from malicious attachments.
D) Applying latest patches addresses known vulnerabilities exploited by email-borne malware, strengthening defense in depth.



A network security analyst, while conducting penetration testing, is aiming to identify a service account password using the Kerberos authentication protocol. They have a valid user authentication ticket (TGT) and decided to carry out a Kerberoasting attack. In the scenario described, which of the following steps should the analyst take next?

  1. Carry out a passive wire sniffing operation using Internet packet sniffers
  2. Perform a PRobability INfinite Chained Elements (PRINCE) attack
  3. Extract plaintext passwords, hashes, PIN codes, and Kerberos tickets using a tool like Mimikatz
  4. Request a service ticket for the service principal name of the target service account

Answer(s): D

Explanation:

Kerberoasting requires requesting a service ticket for the target service principal name to obtain TGS tickets that can be offline crystalline-cracked for service account credentials.
A) Passive wire sniffing is irrelevant to Kerberoasting and Kerberos ticket extraction.
B) PRINCE attack is unrelated to Kerberos service tickets or Kerberoasting flows.
C) Mimikatz can extract credentials but after obtaining a service ticket, not as the immediate next step of Kerberoasting.
D) Correct: requesting a service ticket for the service principal name enables extraction of the TGS for offline cracking.



Viewing page 20 of 105
Viewing questions 153 - 160 out of 862 questions


312-50v13 Exam Discussions & Posts (Share your experience with others)

AI Tutor AI Tutor 👋 I’m here to help!